Quick answers
- Is CVE-2026-20786 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20786 being exploited in the wild.
- How severe is CVE-2026-20786?
- Informational severity, with a CVSS score of 6.9, published 11 August 2026.
- Which products and versions are affected?
- Intel NPU Driver for Linux before 1.32.0; Intel NPU Driver for Windows before 32.0.100.4723.
- Is there a fix for CVE-2026-20786?
- A patch was published on 2026-08-11: Patches available: Linux 1.32.0 and Windows 32.0.100.4723 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-20786 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-20786?
- Check whether you run Intel NPU Driver for Linux or Intel NPU Driver for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is an out-of-bounds read in the Intel NPU Driver affecting Ring 3 user applications. An authenticated local attacker with low complexity can trigger this memory access violation without special knowledge or user interaction, potentially via improper buffer management or bounds checking. The attack vector is local, requiring prior authentication but not elevated privileges. The vulnerability impacts system availability (high severity) and has a minor integrity impact. A patch is available for both Linux (version 1.32.0 or later) and Windows (version 32.0.100.4723 or later).
Affected products
- Intel NPU Driver for Linux before 1.32.0
- Intel NPU Driver for Windows before 32.0.100.4723
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Patches available: Linux 1.32.0 and Windows 32.0.100.4723